How to audit Linux user accounts: passwd, shadow, lastlog, and UID 0

Where accounts live

/etc/passwd lists accounts with name, UID, GID, home directory, and shell. /etc/shadow holds password hashes and aging fields and is readable only by root. getent passwd shows local and directory accounts together if the host uses LDAP or SSSD.

System accounts such as www-data usually have UIDs below 1000 and a shell like /usr/sbin/nologin. Human accounts usually start at 1000.

Checks that find real problems

Only root should have UID 0. A second UID 0 account is a full backdoor with a different name. Accounts with an empty password field in shadow can log in without a password where PAM allows it. Service accounts with a real shell and a password are a target for guessing.

lastlog and last show when each account last logged in. An account with no login in a year belongs to someone who has moved on or a service that was retired.

Snippet

awk -F: '$3==0{print $1}' /etc/passwd
sudo awk -F: '$2==""{print $1}' /etc/shadow
awk -F: '$7!~/(nologin|false)$/{print $1, $3, $7}' /etc/passwd
lastlog -b 365 | tail -n +2
last -n 20

Lab: find and fix a planted account

Create a user called backup2 with UID 0 using useradd -o -u 0, and another with an empty password. Run the checks and confirm both appear. Then remove the UID 0 account with userdel and lock the other with passwd -l and usermod -s /usr/sbin/nologin.

For accounts you keep but rarely use, set an expiry date with chage -E so access ends automatically.

Snippet

sudo useradd -o -u 0 -g 0 -M backup2
awk -F: '$3==0' /etc/passwd
sudo userdel backup2
sudo passwd -l olduser
sudo usermod -s /usr/sbin/nologin olduser
sudo chage -E 2026-12-31 contractor1
sudo chage -l contractor1

Make it a review

A quarterly review compares the account list with the people and services that should exist. HR or an identity system is the source of truth for people, and service owners confirm service accounts.

Look at authorized_keys files in every home directory too. An account with a locked password can still log in over SSH with a key.

Diagram

What each check catches

Run all four; each finds a different problem.

Extra UID 0
A root-equivalent backdoor account.
Empty password
Login without a secret where PAM allows it.
Service account with a shell
Interactive access nobody needs.
No login in a year
Stale access to remove or expire.

Check yourself

1. Why is a second account with UID 0 dangerous?

2. You locked an account’s password. How could it still log in?

3. Which command sets an account to expire on a date?